Analysis
-
max time kernel
123s -
max time network
122s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
13-05-2021 12:57
Static task
static1
Behavioral task
behavioral1
Sample
0c2f07cdc6867474f1449072dd553249f1ef1aa19dac2abef98ba2f4baa15250.exe
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
0c2f07cdc6867474f1449072dd553249f1ef1aa19dac2abef98ba2f4baa15250.exe
Resource
win10v20210410
windows10_x64
0 signatures
0 seconds
General
-
Target
0c2f07cdc6867474f1449072dd553249f1ef1aa19dac2abef98ba2f4baa15250.exe
-
Size
2.0MB
-
MD5
bbb5ac24fff7f744f85c92080b9b3648
-
SHA1
bb74591747b1936d966119c12da21c8836659e0b
-
SHA256
0c2f07cdc6867474f1449072dd553249f1ef1aa19dac2abef98ba2f4baa15250
-
SHA512
b409772bc32dea1d676f3dcca18cdb62fa364c5f32e671ac39c351eed95cca97dbdcfab1fad76cc869af2c4430a1ff18a1c13e792713b9f05424d4a56b889ee3
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
0c2f07cdc6867474f1449072dd553249f1ef1aa19dac2abef98ba2f4baa15250.exepid process 1240 0c2f07cdc6867474f1449072dd553249f1ef1aa19dac2abef98ba2f4baa15250.exe -
Suspicious behavior: MapViewOfSection 20 IoCs
Processes:
0c2f07cdc6867474f1449072dd553249f1ef1aa19dac2abef98ba2f4baa15250.exepid process 1240 0c2f07cdc6867474f1449072dd553249f1ef1aa19dac2abef98ba2f4baa15250.exe 1240 0c2f07cdc6867474f1449072dd553249f1ef1aa19dac2abef98ba2f4baa15250.exe 1240 0c2f07cdc6867474f1449072dd553249f1ef1aa19dac2abef98ba2f4baa15250.exe 1240 0c2f07cdc6867474f1449072dd553249f1ef1aa19dac2abef98ba2f4baa15250.exe 1240 0c2f07cdc6867474f1449072dd553249f1ef1aa19dac2abef98ba2f4baa15250.exe 1240 0c2f07cdc6867474f1449072dd553249f1ef1aa19dac2abef98ba2f4baa15250.exe 1240 0c2f07cdc6867474f1449072dd553249f1ef1aa19dac2abef98ba2f4baa15250.exe 1240 0c2f07cdc6867474f1449072dd553249f1ef1aa19dac2abef98ba2f4baa15250.exe 1240 0c2f07cdc6867474f1449072dd553249f1ef1aa19dac2abef98ba2f4baa15250.exe 1240 0c2f07cdc6867474f1449072dd553249f1ef1aa19dac2abef98ba2f4baa15250.exe 1240 0c2f07cdc6867474f1449072dd553249f1ef1aa19dac2abef98ba2f4baa15250.exe 1240 0c2f07cdc6867474f1449072dd553249f1ef1aa19dac2abef98ba2f4baa15250.exe 1240 0c2f07cdc6867474f1449072dd553249f1ef1aa19dac2abef98ba2f4baa15250.exe 1240 0c2f07cdc6867474f1449072dd553249f1ef1aa19dac2abef98ba2f4baa15250.exe 1240 0c2f07cdc6867474f1449072dd553249f1ef1aa19dac2abef98ba2f4baa15250.exe 1240 0c2f07cdc6867474f1449072dd553249f1ef1aa19dac2abef98ba2f4baa15250.exe 1240 0c2f07cdc6867474f1449072dd553249f1ef1aa19dac2abef98ba2f4baa15250.exe 1240 0c2f07cdc6867474f1449072dd553249f1ef1aa19dac2abef98ba2f4baa15250.exe 1240 0c2f07cdc6867474f1449072dd553249f1ef1aa19dac2abef98ba2f4baa15250.exe 1240 0c2f07cdc6867474f1449072dd553249f1ef1aa19dac2abef98ba2f4baa15250.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
0c2f07cdc6867474f1449072dd553249f1ef1aa19dac2abef98ba2f4baa15250.exedescription pid process Token: SeDebugPrivilege 1240 0c2f07cdc6867474f1449072dd553249f1ef1aa19dac2abef98ba2f4baa15250.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
0c2f07cdc6867474f1449072dd553249f1ef1aa19dac2abef98ba2f4baa15250.exedescription pid process target process PID 1240 wrote to memory of 368 1240 0c2f07cdc6867474f1449072dd553249f1ef1aa19dac2abef98ba2f4baa15250.exe wininit.exe PID 1240 wrote to memory of 368 1240 0c2f07cdc6867474f1449072dd553249f1ef1aa19dac2abef98ba2f4baa15250.exe wininit.exe PID 1240 wrote to memory of 368 1240 0c2f07cdc6867474f1449072dd553249f1ef1aa19dac2abef98ba2f4baa15250.exe wininit.exe PID 1240 wrote to memory of 368 1240 0c2f07cdc6867474f1449072dd553249f1ef1aa19dac2abef98ba2f4baa15250.exe wininit.exe PID 1240 wrote to memory of 368 1240 0c2f07cdc6867474f1449072dd553249f1ef1aa19dac2abef98ba2f4baa15250.exe wininit.exe PID 1240 wrote to memory of 368 1240 0c2f07cdc6867474f1449072dd553249f1ef1aa19dac2abef98ba2f4baa15250.exe wininit.exe PID 1240 wrote to memory of 368 1240 0c2f07cdc6867474f1449072dd553249f1ef1aa19dac2abef98ba2f4baa15250.exe wininit.exe PID 1240 wrote to memory of 380 1240 0c2f07cdc6867474f1449072dd553249f1ef1aa19dac2abef98ba2f4baa15250.exe csrss.exe PID 1240 wrote to memory of 380 1240 0c2f07cdc6867474f1449072dd553249f1ef1aa19dac2abef98ba2f4baa15250.exe csrss.exe PID 1240 wrote to memory of 380 1240 0c2f07cdc6867474f1449072dd553249f1ef1aa19dac2abef98ba2f4baa15250.exe csrss.exe PID 1240 wrote to memory of 380 1240 0c2f07cdc6867474f1449072dd553249f1ef1aa19dac2abef98ba2f4baa15250.exe csrss.exe PID 1240 wrote to memory of 380 1240 0c2f07cdc6867474f1449072dd553249f1ef1aa19dac2abef98ba2f4baa15250.exe csrss.exe PID 1240 wrote to memory of 380 1240 0c2f07cdc6867474f1449072dd553249f1ef1aa19dac2abef98ba2f4baa15250.exe csrss.exe PID 1240 wrote to memory of 380 1240 0c2f07cdc6867474f1449072dd553249f1ef1aa19dac2abef98ba2f4baa15250.exe csrss.exe PID 1240 wrote to memory of 416 1240 0c2f07cdc6867474f1449072dd553249f1ef1aa19dac2abef98ba2f4baa15250.exe winlogon.exe PID 1240 wrote to memory of 416 1240 0c2f07cdc6867474f1449072dd553249f1ef1aa19dac2abef98ba2f4baa15250.exe winlogon.exe PID 1240 wrote to memory of 416 1240 0c2f07cdc6867474f1449072dd553249f1ef1aa19dac2abef98ba2f4baa15250.exe winlogon.exe PID 1240 wrote to memory of 416 1240 0c2f07cdc6867474f1449072dd553249f1ef1aa19dac2abef98ba2f4baa15250.exe winlogon.exe PID 1240 wrote to memory of 416 1240 0c2f07cdc6867474f1449072dd553249f1ef1aa19dac2abef98ba2f4baa15250.exe winlogon.exe PID 1240 wrote to memory of 416 1240 0c2f07cdc6867474f1449072dd553249f1ef1aa19dac2abef98ba2f4baa15250.exe winlogon.exe PID 1240 wrote to memory of 416 1240 0c2f07cdc6867474f1449072dd553249f1ef1aa19dac2abef98ba2f4baa15250.exe winlogon.exe PID 1240 wrote to memory of 460 1240 0c2f07cdc6867474f1449072dd553249f1ef1aa19dac2abef98ba2f4baa15250.exe services.exe PID 1240 wrote to memory of 460 1240 0c2f07cdc6867474f1449072dd553249f1ef1aa19dac2abef98ba2f4baa15250.exe services.exe PID 1240 wrote to memory of 460 1240 0c2f07cdc6867474f1449072dd553249f1ef1aa19dac2abef98ba2f4baa15250.exe services.exe PID 1240 wrote to memory of 460 1240 0c2f07cdc6867474f1449072dd553249f1ef1aa19dac2abef98ba2f4baa15250.exe services.exe PID 1240 wrote to memory of 460 1240 0c2f07cdc6867474f1449072dd553249f1ef1aa19dac2abef98ba2f4baa15250.exe services.exe PID 1240 wrote to memory of 460 1240 0c2f07cdc6867474f1449072dd553249f1ef1aa19dac2abef98ba2f4baa15250.exe services.exe PID 1240 wrote to memory of 460 1240 0c2f07cdc6867474f1449072dd553249f1ef1aa19dac2abef98ba2f4baa15250.exe services.exe PID 1240 wrote to memory of 476 1240 0c2f07cdc6867474f1449072dd553249f1ef1aa19dac2abef98ba2f4baa15250.exe lsass.exe PID 1240 wrote to memory of 476 1240 0c2f07cdc6867474f1449072dd553249f1ef1aa19dac2abef98ba2f4baa15250.exe lsass.exe PID 1240 wrote to memory of 476 1240 0c2f07cdc6867474f1449072dd553249f1ef1aa19dac2abef98ba2f4baa15250.exe lsass.exe PID 1240 wrote to memory of 476 1240 0c2f07cdc6867474f1449072dd553249f1ef1aa19dac2abef98ba2f4baa15250.exe lsass.exe PID 1240 wrote to memory of 476 1240 0c2f07cdc6867474f1449072dd553249f1ef1aa19dac2abef98ba2f4baa15250.exe lsass.exe PID 1240 wrote to memory of 476 1240 0c2f07cdc6867474f1449072dd553249f1ef1aa19dac2abef98ba2f4baa15250.exe lsass.exe PID 1240 wrote to memory of 476 1240 0c2f07cdc6867474f1449072dd553249f1ef1aa19dac2abef98ba2f4baa15250.exe lsass.exe PID 1240 wrote to memory of 484 1240 0c2f07cdc6867474f1449072dd553249f1ef1aa19dac2abef98ba2f4baa15250.exe lsm.exe PID 1240 wrote to memory of 484 1240 0c2f07cdc6867474f1449072dd553249f1ef1aa19dac2abef98ba2f4baa15250.exe lsm.exe PID 1240 wrote to memory of 484 1240 0c2f07cdc6867474f1449072dd553249f1ef1aa19dac2abef98ba2f4baa15250.exe lsm.exe PID 1240 wrote to memory of 484 1240 0c2f07cdc6867474f1449072dd553249f1ef1aa19dac2abef98ba2f4baa15250.exe lsm.exe PID 1240 wrote to memory of 484 1240 0c2f07cdc6867474f1449072dd553249f1ef1aa19dac2abef98ba2f4baa15250.exe lsm.exe PID 1240 wrote to memory of 484 1240 0c2f07cdc6867474f1449072dd553249f1ef1aa19dac2abef98ba2f4baa15250.exe lsm.exe PID 1240 wrote to memory of 484 1240 0c2f07cdc6867474f1449072dd553249f1ef1aa19dac2abef98ba2f4baa15250.exe lsm.exe PID 1240 wrote to memory of 580 1240 0c2f07cdc6867474f1449072dd553249f1ef1aa19dac2abef98ba2f4baa15250.exe svchost.exe PID 1240 wrote to memory of 580 1240 0c2f07cdc6867474f1449072dd553249f1ef1aa19dac2abef98ba2f4baa15250.exe svchost.exe PID 1240 wrote to memory of 580 1240 0c2f07cdc6867474f1449072dd553249f1ef1aa19dac2abef98ba2f4baa15250.exe svchost.exe PID 1240 wrote to memory of 580 1240 0c2f07cdc6867474f1449072dd553249f1ef1aa19dac2abef98ba2f4baa15250.exe svchost.exe PID 1240 wrote to memory of 580 1240 0c2f07cdc6867474f1449072dd553249f1ef1aa19dac2abef98ba2f4baa15250.exe svchost.exe PID 1240 wrote to memory of 580 1240 0c2f07cdc6867474f1449072dd553249f1ef1aa19dac2abef98ba2f4baa15250.exe svchost.exe PID 1240 wrote to memory of 580 1240 0c2f07cdc6867474f1449072dd553249f1ef1aa19dac2abef98ba2f4baa15250.exe svchost.exe PID 1240 wrote to memory of 660 1240 0c2f07cdc6867474f1449072dd553249f1ef1aa19dac2abef98ba2f4baa15250.exe svchost.exe PID 1240 wrote to memory of 660 1240 0c2f07cdc6867474f1449072dd553249f1ef1aa19dac2abef98ba2f4baa15250.exe svchost.exe PID 1240 wrote to memory of 660 1240 0c2f07cdc6867474f1449072dd553249f1ef1aa19dac2abef98ba2f4baa15250.exe svchost.exe PID 1240 wrote to memory of 660 1240 0c2f07cdc6867474f1449072dd553249f1ef1aa19dac2abef98ba2f4baa15250.exe svchost.exe PID 1240 wrote to memory of 660 1240 0c2f07cdc6867474f1449072dd553249f1ef1aa19dac2abef98ba2f4baa15250.exe svchost.exe PID 1240 wrote to memory of 660 1240 0c2f07cdc6867474f1449072dd553249f1ef1aa19dac2abef98ba2f4baa15250.exe svchost.exe PID 1240 wrote to memory of 660 1240 0c2f07cdc6867474f1449072dd553249f1ef1aa19dac2abef98ba2f4baa15250.exe svchost.exe PID 1240 wrote to memory of 736 1240 0c2f07cdc6867474f1449072dd553249f1ef1aa19dac2abef98ba2f4baa15250.exe svchost.exe PID 1240 wrote to memory of 736 1240 0c2f07cdc6867474f1449072dd553249f1ef1aa19dac2abef98ba2f4baa15250.exe svchost.exe PID 1240 wrote to memory of 736 1240 0c2f07cdc6867474f1449072dd553249f1ef1aa19dac2abef98ba2f4baa15250.exe svchost.exe PID 1240 wrote to memory of 736 1240 0c2f07cdc6867474f1449072dd553249f1ef1aa19dac2abef98ba2f4baa15250.exe svchost.exe PID 1240 wrote to memory of 736 1240 0c2f07cdc6867474f1449072dd553249f1ef1aa19dac2abef98ba2f4baa15250.exe svchost.exe PID 1240 wrote to memory of 736 1240 0c2f07cdc6867474f1449072dd553249f1ef1aa19dac2abef98ba2f4baa15250.exe svchost.exe PID 1240 wrote to memory of 736 1240 0c2f07cdc6867474f1449072dd553249f1ef1aa19dac2abef98ba2f4baa15250.exe svchost.exe PID 1240 wrote to memory of 800 1240 0c2f07cdc6867474f1449072dd553249f1ef1aa19dac2abef98ba2f4baa15250.exe svchost.exe
Processes
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe1⤵
-
C:\Windows\system32\services.exeC:\Windows\system32\services.exe1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted2⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService2⤵
-
C:\Windows\system32\taskhost.exe"taskhost.exe"2⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork2⤵
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe2⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs2⤵
-
C:\Windows\system32\wbem\WMIADAP.EXEwmiadap.exe /F /T /R3⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService2⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted2⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k RPCSS2⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch2⤵
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵
-
C:\Windows\system32\wininit.exewininit.exe1⤵
-
C:\Windows\system32\lsm.exeC:\Windows\system32\lsm.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\596076891\zmstage.exeC:\Users\Admin\AppData\Local\Temp\596076891\zmstage.exe1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\0c2f07cdc6867474f1449072dd553249f1ef1aa19dac2abef98ba2f4baa15250.exe"C:\Users\Admin\AppData\Local\Temp\0c2f07cdc6867474f1449072dd553249f1ef1aa19dac2abef98ba2f4baa15250.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵